[Rspamd-Users] Regex – how to do it right?

[Andrew Lewis]

Hi Tino,

Use regex rules where possible, see here for additional information
about them:

https://rspamd.com/doc/modules/regexp.html

If you need/want to use maps, multimap may be a reasonable choice. If
you need flexibility beyond what's possible with regex rules you may
want to reach for Lua (or some combination of regex & Lua).

The correct path for rspamd.local.lua is directly under /etc/rspamd
(not under local.d).

You'd want something similar to as below I suppose:

config['regexp']['PAKETE_TEST'] = {
  -- use square quotes to avoid escaping, set match type
  re = [[/ *<p>Kunden.*<\/p>/{sa_raw_body}]],
  score = 10.0,
}

Best,
-AL.

On Thu, 2024-01-04 at 11:42 +0100, Tino Hendricks wrote:
> Dear list,
> 
> being new to rspamd I too often struggle with the (too?) extensive
> manuals.
> 
> I want to filter out the annoying parcel delivery spams coming from
> hotmail that obviously don’t get learned by Bayes.
> It’s a multiline HTML that I consider the sufficient characteristic.
> (For testing purpose I started with a one line snippet.)
> 
> From the manuals I think there are 3 ways to go:
> 1. Mulitmap:
>  https://rspamd.com/doc/modules/multimap.html#regexp-maps
> 2. Rules (Regex)
>  https://rspamd.com/doc/tutorials/writing_rules.html#regexp-rules
> 3. Rules (Lua)
>  https://rspamd.com/doc/tutorials/writing_rules.html#lua-rules
> 
> 
> I tried #2 by putting 
> 
> config['regexp‘][PAKETE_TEST'] = '/ *<p>Kunden.*<\/p>/'
> 
> into /etc/rspamd/local.d/rspamd.local.lua to no avail
> 
> Next I tried #3 with 
> 
> config['regexp']['PAKETE_TEST'] = {
>     re = '/ *<p>Kunden.*<\/p>/',
>     score = 10.0,
>     condition = function(task) -- run this rule only if some
> condition is satisfied
>         return true
>     end,
> }
> 
> into /etc/rspamd/local.d/pakete_rules.lua to no avail
> 
> #1 works but this seems to be the least comfortable way if it comes
> to many and maybe complex Regexes.
> 
> How do you do it?
> 
> Thanks,
> 
> Tino